cd DIR does the foillowing: cdcmd() -> docd() -> updatepwd(), and updatepwd has the code which "normalizes" the DIR: prepends current dir if DIR is not absolute, then eliminates "SUBDIR/.." sections. The bug is, it does not care whether SUBDIR exists. cd BOGUSDIR/.. always works - it chdir's into current directory.